Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
16-05-2024 17:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-16_2a09cd260adaf0da805a67c56d06d255_mafia.exe
Resource
win7-20240220-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-16_2a09cd260adaf0da805a67c56d06d255_mafia.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-05-16_2a09cd260adaf0da805a67c56d06d255_mafia.exe
-
Size
536KB
-
MD5
2a09cd260adaf0da805a67c56d06d255
-
SHA1
83a3d13a5584009965b6030605ccbc460057af3c
-
SHA256
c46d3b5c12e9d404dcfe956d289a84911c2b762aaa37210e3b07c8cf30140864
-
SHA512
0d36ae2a97afa4d595b3498209ed15319ffb4991e36715367cc031b7efcd1cc5d97d6fd68509d1370839545648c4795a3f040b667192d0803fe2d46f10dbe1ff
-
SSDEEP
12288:wU5rCOTeiUDqIEYPKES5bOd4i6UnM5i4kCYtUIZxVJ0ZT9:wUQOJUDqGO+60M5i4kRtUIRJ0ZT9
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1996 AAB.tmp 3004 AE9.tmp 2604 B28.tmp 2656 B76.tmp 2844 BC4.tmp 2484 C02.tmp 2712 C40.tmp 2516 C7F.tmp 1128 CCD.tmp 1228 D1B.tmp 2788 D59.tmp 2904 DA7.tmp 2024 DE6.tmp 2332 E24.tmp 2368 E82.tmp 332 ED0.tmp 1892 F2D.tmp 1528 F7B.tmp 2124 1017.tmp 2864 1056.tmp 2376 1101.tmp 596 118E.tmp 708 11FB.tmp 1484 1278.tmp 1884 12C6.tmp 2256 1314.tmp 924 1371.tmp 2424 13B0.tmp 2144 13FE.tmp 1356 143C.tmp 2160 14A9.tmp 648 1507.tmp 2868 1555.tmp 1640 1593.tmp 1240 15E1.tmp 344 162F.tmp 1080 166E.tmp 1504 16CB.tmp 1704 1729.tmp 1576 1767.tmp 2964 17A6.tmp 1996 17E4.tmp 2856 1822.tmp 2464 1861.tmp 2708 18AF.tmp 2512 18ED.tmp 2528 192C.tmp 1128 196A.tmp 2820 19A8.tmp 1856 19E7.tmp 2024 1A25.tmp 2336 1A64.tmp 2524 1A92.tmp 1560 1AD1.tmp 1264 1B0F.tmp 1432 1B4E.tmp 1496 1B8C.tmp 2436 1BCA.tmp 2072 1C09.tmp 2096 1C47.tmp 2724 1C86.tmp 392 1CC4.tmp 764 1D02.tmp 616 1D41.tmp -
Loads dropped DLL 64 IoCs
pid Process 2012 2024-05-16_2a09cd260adaf0da805a67c56d06d255_mafia.exe 1996 AAB.tmp 3004 AE9.tmp 2604 B28.tmp 2656 B76.tmp 2844 BC4.tmp 2484 C02.tmp 2712 C40.tmp 2516 C7F.tmp 1128 CCD.tmp 1228 D1B.tmp 2788 D59.tmp 2904 DA7.tmp 2024 DE6.tmp 2332 E24.tmp 2368 E82.tmp 332 ED0.tmp 1892 F2D.tmp 1528 F7B.tmp 2124 1017.tmp 2864 1056.tmp 2376 1101.tmp 596 118E.tmp 708 11FB.tmp 1484 1278.tmp 1884 12C6.tmp 2256 1314.tmp 924 1371.tmp 2424 13B0.tmp 2144 13FE.tmp 1356 143C.tmp 2160 14A9.tmp 648 1507.tmp 2868 1555.tmp 1640 1593.tmp 1240 15E1.tmp 344 162F.tmp 1080 166E.tmp 1504 16CB.tmp 1704 1729.tmp 1576 1767.tmp 2964 17A6.tmp 1996 17E4.tmp 2856 1822.tmp 2464 1861.tmp 2708 18AF.tmp 2512 18ED.tmp 2528 192C.tmp 1128 196A.tmp 2820 19A8.tmp 1856 19E7.tmp 2024 1A25.tmp 2336 1A64.tmp 2524 1A92.tmp 1560 1AD1.tmp 1264 1B0F.tmp 1432 1B4E.tmp 1496 1B8C.tmp 2436 1BCA.tmp 2072 1C09.tmp 2096 1C47.tmp 2724 1C86.tmp 392 1CC4.tmp 764 1D02.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2012 wrote to memory of 1996 2012 2024-05-16_2a09cd260adaf0da805a67c56d06d255_mafia.exe 28 PID 2012 wrote to memory of 1996 2012 2024-05-16_2a09cd260adaf0da805a67c56d06d255_mafia.exe 28 PID 2012 wrote to memory of 1996 2012 2024-05-16_2a09cd260adaf0da805a67c56d06d255_mafia.exe 28 PID 2012 wrote to memory of 1996 2012 2024-05-16_2a09cd260adaf0da805a67c56d06d255_mafia.exe 28 PID 1996 wrote to memory of 3004 1996 AAB.tmp 29 PID 1996 wrote to memory of 3004 1996 AAB.tmp 29 PID 1996 wrote to memory of 3004 1996 AAB.tmp 29 PID 1996 wrote to memory of 3004 1996 AAB.tmp 29 PID 3004 wrote to memory of 2604 3004 AE9.tmp 30 PID 3004 wrote to memory of 2604 3004 AE9.tmp 30 PID 3004 wrote to memory of 2604 3004 AE9.tmp 30 PID 3004 wrote to memory of 2604 3004 AE9.tmp 30 PID 2604 wrote to memory of 2656 2604 B28.tmp 31 PID 2604 wrote to memory of 2656 2604 B28.tmp 31 PID 2604 wrote to memory of 2656 2604 B28.tmp 31 PID 2604 wrote to memory of 2656 2604 B28.tmp 31 PID 2656 wrote to memory of 2844 2656 B76.tmp 32 PID 2656 wrote to memory of 2844 2656 B76.tmp 32 PID 2656 wrote to memory of 2844 2656 B76.tmp 32 PID 2656 wrote to memory of 2844 2656 B76.tmp 32 PID 2844 wrote to memory of 2484 2844 BC4.tmp 33 PID 2844 wrote to memory of 2484 2844 BC4.tmp 33 PID 2844 wrote to memory of 2484 2844 BC4.tmp 33 PID 2844 wrote to memory of 2484 2844 BC4.tmp 33 PID 2484 wrote to memory of 2712 2484 C02.tmp 34 PID 2484 wrote to memory of 2712 2484 C02.tmp 34 PID 2484 wrote to memory of 2712 2484 C02.tmp 34 PID 2484 wrote to memory of 2712 2484 C02.tmp 34 PID 2712 wrote to memory of 2516 2712 C40.tmp 35 PID 2712 wrote to memory of 2516 2712 C40.tmp 35 PID 2712 wrote to memory of 2516 2712 C40.tmp 35 PID 2712 wrote to memory of 2516 2712 C40.tmp 35 PID 2516 wrote to memory of 1128 2516 C7F.tmp 36 PID 2516 wrote to memory of 1128 2516 C7F.tmp 36 PID 2516 wrote to memory of 1128 2516 C7F.tmp 36 PID 2516 wrote to memory of 1128 2516 C7F.tmp 36 PID 1128 wrote to memory of 1228 1128 CCD.tmp 37 PID 1128 wrote to memory of 1228 1128 CCD.tmp 37 PID 1128 wrote to memory of 1228 1128 CCD.tmp 37 PID 1128 wrote to memory of 1228 1128 CCD.tmp 37 PID 1228 wrote to memory of 2788 1228 D1B.tmp 38 PID 1228 wrote to memory of 2788 1228 D1B.tmp 38 PID 1228 wrote to memory of 2788 1228 D1B.tmp 38 PID 1228 wrote to memory of 2788 1228 D1B.tmp 38 PID 2788 wrote to memory of 2904 2788 D59.tmp 39 PID 2788 wrote to memory of 2904 2788 D59.tmp 39 PID 2788 wrote to memory of 2904 2788 D59.tmp 39 PID 2788 wrote to memory of 2904 2788 D59.tmp 39 PID 2904 wrote to memory of 2024 2904 DA7.tmp 40 PID 2904 wrote to memory of 2024 2904 DA7.tmp 40 PID 2904 wrote to memory of 2024 2904 DA7.tmp 40 PID 2904 wrote to memory of 2024 2904 DA7.tmp 40 PID 2024 wrote to memory of 2332 2024 DE6.tmp 41 PID 2024 wrote to memory of 2332 2024 DE6.tmp 41 PID 2024 wrote to memory of 2332 2024 DE6.tmp 41 PID 2024 wrote to memory of 2332 2024 DE6.tmp 41 PID 2332 wrote to memory of 2368 2332 E24.tmp 42 PID 2332 wrote to memory of 2368 2332 E24.tmp 42 PID 2332 wrote to memory of 2368 2332 E24.tmp 42 PID 2332 wrote to memory of 2368 2332 E24.tmp 42 PID 2368 wrote to memory of 332 2368 E82.tmp 43 PID 2368 wrote to memory of 332 2368 E82.tmp 43 PID 2368 wrote to memory of 332 2368 E82.tmp 43 PID 2368 wrote to memory of 332 2368 E82.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-16_2a09cd260adaf0da805a67c56d06d255_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-16_2a09cd260adaf0da805a67c56d06d255_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\AAB.tmp"C:\Users\Admin\AppData\Local\Temp\AAB.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\AE9.tmp"C:\Users\Admin\AppData\Local\Temp\AE9.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\B28.tmp"C:\Users\Admin\AppData\Local\Temp\B28.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\B76.tmp"C:\Users\Admin\AppData\Local\Temp\B76.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\BC4.tmp"C:\Users\Admin\AppData\Local\Temp\BC4.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\C02.tmp"C:\Users\Admin\AppData\Local\Temp\C02.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\C40.tmp"C:\Users\Admin\AppData\Local\Temp\C40.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\C7F.tmp"C:\Users\Admin\AppData\Local\Temp\C7F.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\CCD.tmp"C:\Users\Admin\AppData\Local\Temp\CCD.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\D1B.tmp"C:\Users\Admin\AppData\Local\Temp\D1B.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\D59.tmp"C:\Users\Admin\AppData\Local\Temp\D59.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\DA7.tmp"C:\Users\Admin\AppData\Local\Temp\DA7.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\DE6.tmp"C:\Users\Admin\AppData\Local\Temp\DE6.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\E24.tmp"C:\Users\Admin\AppData\Local\Temp\E24.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\E82.tmp"C:\Users\Admin\AppData\Local\Temp\E82.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\ED0.tmp"C:\Users\Admin\AppData\Local\Temp\ED0.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:332 -
C:\Users\Admin\AppData\Local\Temp\F2D.tmp"C:\Users\Admin\AppData\Local\Temp\F2D.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\F7B.tmp"C:\Users\Admin\AppData\Local\Temp\F7B.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\1017.tmp"C:\Users\Admin\AppData\Local\Temp\1017.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\1056.tmp"C:\Users\Admin\AppData\Local\Temp\1056.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\1101.tmp"C:\Users\Admin\AppData\Local\Temp\1101.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\118E.tmp"C:\Users\Admin\AppData\Local\Temp\118E.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:596 -
C:\Users\Admin\AppData\Local\Temp\11FB.tmp"C:\Users\Admin\AppData\Local\Temp\11FB.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:708 -
C:\Users\Admin\AppData\Local\Temp\1278.tmp"C:\Users\Admin\AppData\Local\Temp\1278.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\12C6.tmp"C:\Users\Admin\AppData\Local\Temp\12C6.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\1314.tmp"C:\Users\Admin\AppData\Local\Temp\1314.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\1371.tmp"C:\Users\Admin\AppData\Local\Temp\1371.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:924 -
C:\Users\Admin\AppData\Local\Temp\13B0.tmp"C:\Users\Admin\AppData\Local\Temp\13B0.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\13FE.tmp"C:\Users\Admin\AppData\Local\Temp\13FE.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\143C.tmp"C:\Users\Admin\AppData\Local\Temp\143C.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\14A9.tmp"C:\Users\Admin\AppData\Local\Temp\14A9.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\1507.tmp"C:\Users\Admin\AppData\Local\Temp\1507.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:648 -
C:\Users\Admin\AppData\Local\Temp\1555.tmp"C:\Users\Admin\AppData\Local\Temp\1555.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\1593.tmp"C:\Users\Admin\AppData\Local\Temp\1593.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\15E1.tmp"C:\Users\Admin\AppData\Local\Temp\15E1.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\162F.tmp"C:\Users\Admin\AppData\Local\Temp\162F.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:344 -
C:\Users\Admin\AppData\Local\Temp\166E.tmp"C:\Users\Admin\AppData\Local\Temp\166E.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\16CB.tmp"C:\Users\Admin\AppData\Local\Temp\16CB.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\1729.tmp"C:\Users\Admin\AppData\Local\Temp\1729.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\1767.tmp"C:\Users\Admin\AppData\Local\Temp\1767.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\17A6.tmp"C:\Users\Admin\AppData\Local\Temp\17A6.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\17E4.tmp"C:\Users\Admin\AppData\Local\Temp\17E4.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\1822.tmp"C:\Users\Admin\AppData\Local\Temp\1822.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\1861.tmp"C:\Users\Admin\AppData\Local\Temp\1861.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\18AF.tmp"C:\Users\Admin\AppData\Local\Temp\18AF.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\18ED.tmp"C:\Users\Admin\AppData\Local\Temp\18ED.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\192C.tmp"C:\Users\Admin\AppData\Local\Temp\192C.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\196A.tmp"C:\Users\Admin\AppData\Local\Temp\196A.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\19A8.tmp"C:\Users\Admin\AppData\Local\Temp\19A8.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\19E7.tmp"C:\Users\Admin\AppData\Local\Temp\19E7.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\1A25.tmp"C:\Users\Admin\AppData\Local\Temp\1A25.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\1A64.tmp"C:\Users\Admin\AppData\Local\Temp\1A64.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\1A92.tmp"C:\Users\Admin\AppData\Local\Temp\1A92.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\1AD1.tmp"C:\Users\Admin\AppData\Local\Temp\1AD1.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\1B0F.tmp"C:\Users\Admin\AppData\Local\Temp\1B0F.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\1B4E.tmp"C:\Users\Admin\AppData\Local\Temp\1B4E.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\1B8C.tmp"C:\Users\Admin\AppData\Local\Temp\1B8C.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\1BCA.tmp"C:\Users\Admin\AppData\Local\Temp\1BCA.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\1C09.tmp"C:\Users\Admin\AppData\Local\Temp\1C09.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\1C47.tmp"C:\Users\Admin\AppData\Local\Temp\1C47.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\1C86.tmp"C:\Users\Admin\AppData\Local\Temp\1C86.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\1CC4.tmp"C:\Users\Admin\AppData\Local\Temp\1CC4.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:392 -
C:\Users\Admin\AppData\Local\Temp\1D02.tmp"C:\Users\Admin\AppData\Local\Temp\1D02.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:764 -
C:\Users\Admin\AppData\Local\Temp\1D41.tmp"C:\Users\Admin\AppData\Local\Temp\1D41.tmp"65⤵
- Executes dropped EXE
PID:616 -
C:\Users\Admin\AppData\Local\Temp\1D7F.tmp"C:\Users\Admin\AppData\Local\Temp\1D7F.tmp"66⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\1DCD.tmp"C:\Users\Admin\AppData\Local\Temp\1DCD.tmp"67⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\1E0C.tmp"C:\Users\Admin\AppData\Local\Temp\1E0C.tmp"68⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\1E69.tmp"C:\Users\Admin\AppData\Local\Temp\1E69.tmp"69⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\1EA8.tmp"C:\Users\Admin\AppData\Local\Temp\1EA8.tmp"70⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\1EE6.tmp"C:\Users\Admin\AppData\Local\Temp\1EE6.tmp"71⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\1F24.tmp"C:\Users\Admin\AppData\Local\Temp\1F24.tmp"72⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\1F63.tmp"C:\Users\Admin\AppData\Local\Temp\1F63.tmp"73⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\1F92.tmp"C:\Users\Admin\AppData\Local\Temp\1F92.tmp"74⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\1FD0.tmp"C:\Users\Admin\AppData\Local\Temp\1FD0.tmp"75⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\200E.tmp"C:\Users\Admin\AppData\Local\Temp\200E.tmp"76⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\204D.tmp"C:\Users\Admin\AppData\Local\Temp\204D.tmp"77⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\208B.tmp"C:\Users\Admin\AppData\Local\Temp\208B.tmp"78⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\20CA.tmp"C:\Users\Admin\AppData\Local\Temp\20CA.tmp"79⤵PID:848
-
C:\Users\Admin\AppData\Local\Temp\2108.tmp"C:\Users\Admin\AppData\Local\Temp\2108.tmp"80⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\2146.tmp"C:\Users\Admin\AppData\Local\Temp\2146.tmp"81⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\2185.tmp"C:\Users\Admin\AppData\Local\Temp\2185.tmp"82⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\21C3.tmp"C:\Users\Admin\AppData\Local\Temp\21C3.tmp"83⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\21F2.tmp"C:\Users\Admin\AppData\Local\Temp\21F2.tmp"84⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\2230.tmp"C:\Users\Admin\AppData\Local\Temp\2230.tmp"85⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\226F.tmp"C:\Users\Admin\AppData\Local\Temp\226F.tmp"86⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\22AD.tmp"C:\Users\Admin\AppData\Local\Temp\22AD.tmp"87⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\22EC.tmp"C:\Users\Admin\AppData\Local\Temp\22EC.tmp"88⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\232A.tmp"C:\Users\Admin\AppData\Local\Temp\232A.tmp"89⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\2368.tmp"C:\Users\Admin\AppData\Local\Temp\2368.tmp"90⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\23A7.tmp"C:\Users\Admin\AppData\Local\Temp\23A7.tmp"91⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\23E5.tmp"C:\Users\Admin\AppData\Local\Temp\23E5.tmp"92⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\2424.tmp"C:\Users\Admin\AppData\Local\Temp\2424.tmp"93⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\2462.tmp"C:\Users\Admin\AppData\Local\Temp\2462.tmp"94⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\24A0.tmp"C:\Users\Admin\AppData\Local\Temp\24A0.tmp"95⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\24DF.tmp"C:\Users\Admin\AppData\Local\Temp\24DF.tmp"96⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\251D.tmp"C:\Users\Admin\AppData\Local\Temp\251D.tmp"97⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\255C.tmp"C:\Users\Admin\AppData\Local\Temp\255C.tmp"98⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\259A.tmp"C:\Users\Admin\AppData\Local\Temp\259A.tmp"99⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\25C9.tmp"C:\Users\Admin\AppData\Local\Temp\25C9.tmp"100⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\2607.tmp"C:\Users\Admin\AppData\Local\Temp\2607.tmp"101⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\2636.tmp"C:\Users\Admin\AppData\Local\Temp\2636.tmp"102⤵PID:1396
-
C:\Users\Admin\AppData\Local\Temp\2665.tmp"C:\Users\Admin\AppData\Local\Temp\2665.tmp"103⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\26A3.tmp"C:\Users\Admin\AppData\Local\Temp\26A3.tmp"104⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\26E2.tmp"C:\Users\Admin\AppData\Local\Temp\26E2.tmp"105⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\2720.tmp"C:\Users\Admin\AppData\Local\Temp\2720.tmp"106⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\275E.tmp"C:\Users\Admin\AppData\Local\Temp\275E.tmp"107⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\279D.tmp"C:\Users\Admin\AppData\Local\Temp\279D.tmp"108⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\27CC.tmp"C:\Users\Admin\AppData\Local\Temp\27CC.tmp"109⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\280A.tmp"C:\Users\Admin\AppData\Local\Temp\280A.tmp"110⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\2848.tmp"C:\Users\Admin\AppData\Local\Temp\2848.tmp"111⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\2887.tmp"C:\Users\Admin\AppData\Local\Temp\2887.tmp"112⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\28C5.tmp"C:\Users\Admin\AppData\Local\Temp\28C5.tmp"113⤵PID:988
-
C:\Users\Admin\AppData\Local\Temp\2904.tmp"C:\Users\Admin\AppData\Local\Temp\2904.tmp"114⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\2942.tmp"C:\Users\Admin\AppData\Local\Temp\2942.tmp"115⤵PID:708
-
C:\Users\Admin\AppData\Local\Temp\2980.tmp"C:\Users\Admin\AppData\Local\Temp\2980.tmp"116⤵PID:616
-
C:\Users\Admin\AppData\Local\Temp\29BF.tmp"C:\Users\Admin\AppData\Local\Temp\29BF.tmp"117⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\29EE.tmp"C:\Users\Admin\AppData\Local\Temp\29EE.tmp"118⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\2A2C.tmp"C:\Users\Admin\AppData\Local\Temp\2A2C.tmp"119⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\2A5B.tmp"C:\Users\Admin\AppData\Local\Temp\2A5B.tmp"120⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\2A99.tmp"C:\Users\Admin\AppData\Local\Temp\2A99.tmp"121⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\2AD8.tmp"C:\Users\Admin\AppData\Local\Temp\2AD8.tmp"122⤵PID:924
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-